cn

func AddPortMapping ¶

func AddPortMapping(ctx context.Context, hostPort uint16, containerIPAndCIDR string, containerPort uint16) error

AddPortMapping adds an iptables DNAT rule that forwards traffic arriving on the host's hostPort to the container at containerIP:containerPort. Idempotent, safe to call on every reconciliation tick. containerIPAndCIDR assumes the following format "10.0.0.0/16".

func AllocateIP ¶

func AllocateIP() string

AllocateIP allocates an available IP address and returns that as a string of IP + CIDR.

func CreateBridge ¶

func CreateBridge(ctx context.Context, nodeIndex int) error

CreateBridge ensures the cn0 bridge exists, is up, and has 10.0.{nodeIndex}.1/24 assigned. It is idempotent, safe to call on every startup.

func CreateVethPair ¶

func CreateVethPair(ctx context.Context, containerID string, namespacePID int) (string, error)

CreateVethPair creates a veth pair for a workload, moves the container end into the workload's network namespace, attaches the host end to cn0, and brings the host end up. Returns a CIDR of the container network and an error.

func DeleteLink ¶

func DeleteLink(linkName string) error

DeleteLink removes the host end of a veth pair from the system. The container end is cleaned up by the kernel when the network namespace dies.

func RemovePortMapping ¶

func RemovePortMapping(ctx context.Context, hostPort uint16, containerIPAndCIDR string, containerPort uint16) error

RemovePortMapping removes the DNAT rule for hostPort. Safe to call even if the rule does not exist. Call when the container stops. containerIPAndCIDR assumes the following format "10.0.0.0/16".

func RunTunnelManager ¶

func RunTunnelManager(
	ctx context.Context,
	logger *zap.Logger,
	peerService *peerdiscovery.MemberService,
	nodeID uuid.UUID,
	myKey Key,
	listenPort int,
)

RunTunnelManager continuously reconciles WireGuard overlay tunnels with cluster membership.

func SetNodeSubnet ¶

func SetNodeSubnet(index int)

SetNodeSubnet configures the base container IP allocation pool for this node using its deterministic cluster-wide subnet index (10.0.<index>.2 onwards).

func SetupMasquerade ¶

func SetupMasquerade(ctx context.Context) error

SetupMasquerade adds an iptables SNAT rule on the host so containers in the bridge subnet can reach the internet. Outbound packets from 10.0.0.0/16 get their source address rewritten to the host's external IP. Container-to-container traffic on cn0 is excluded. Idempotent, safe to call on every startup.

func SyncTunnels ¶

func SyncTunnels(
	ctx context.Context,
	logger *zap.Logger,
	peerService *peerdiscovery.MemberService,
	nodeID uuid.UUID,
	myKey Key,
	listenPort int,
) error

SyncTunnels discovers active cluster peers from memberlist, provisions point-to-point WireGuard links for each alive peer, configures routing into their assigned /24 subnets, and removes tunnels for departed peers.

func TeardownAllTunnels ¶

func TeardownAllTunnels(logger *zap.Logger) error

TeardownAllTunnels removes all active WireGuard interfaces starting with the "wg-" prefix.

func TeardownMasquerade ¶

func TeardownMasquerade() error

TeardownMasquerade removes the masquerade SNAT rule added by SetupMasquerade. Safe to call even if the rule was already removed or never added. Call on shutdown.

func VethHostName ¶

func VethHostName(containerID string, whichEnd VethEnd) string

func WGInterfaceName ¶

func WGInterfaceName(id uuid.UUID) string

WGInterfaceName computes a deterministic interface name for a peer UUID that conforms to Linux's 15-character IFNAMSIZ limit (e.g., "wg-a1b2c3d4").